I feel registration is something which should come disabled by default and need to be explicitly enabled.

At least on Conduit and Dendrite that is the case iirc, but it's easy to forget to disable it once you register an account.

It may be. I setup my server half a decade ago and don't remember exactly how I configured it initially. I may have enabled it not realizing the implications.